filenameexconfig.dll
size1200142 (0x12500e)
md56409bc1e87139bd9d6c6a6b63d17635d
typePE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections0xb
TimeDateStamp0
PointerToSymbolTable0x125000
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x230e
Magic0x10b
LinkerVersion2.34
SizeOfCode0xc8a00
SizeOfInitializedData0x124c00
SizeOfUninitializedData0xe00
AddressOfEntryPoint0x13b0
BaseOfCode0x1000
BaseOfData0xca000
ImageBase0x6b1c0000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x12d000
SizeOfHeaders0x400
CheckSum0x12b4fb
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xc88e80xc8a00R-X CODE IDATA
.data0xca0000x1c2c0x1e00RW- IDATA
.rdata0xcc0000xd9e80xda00R-- IDATA
/40xda0000x43ae40x43c00R-- IDATA
.bss0x11e0000xd000RW- UDATA
.edata0x11f0000xaf0x200R-- IDATA
.idata0x1200000x103c0x1200RW- IDATA
.CRT0x1220000x300x200RW- IDATA
.tls0x12300080x200RW- IDATA
.rsrc0x1240000x3b00x400RW- IDATA
.reloc0x1250000x70800x7200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x11f0000xaf
IMPORT0x1200000x103c
RESOURCE0x1240000x3b0
EXCEPTION00
SECURITY00
BASERELOC0x1250000x7080
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0xd0d3c0x18
LOAD_CONFIG00
Bound_IAT00
IAT0x1202b80x27c
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x6b2e30000x6b2e30040x6b2de1440x6b2e201800
typenamesizecp
VERSION#18560
module_namehintordfunction_name
KERNEL32.dll21AddVectoredExceptionHandler
KERNEL32.dll136CloseHandle
KERNEL32.dll192CreateEventA
KERNEL32.dll237CreateSemaphoreA
KERNEL32.dll277DeleteCriticalSection
KERNEL32.dll304DuplicateHandle
KERNEL32.dll310EnterCriticalSection
KERNEL32.dll379FindClose
KERNEL32.dll383FindFirstFileA
KERNEL32.dll400FindNextFileA
KERNEL32.dll428FormatMessageA
KERNEL32.dll433FreeLibrary
KERNEL32.dll543GetCurrentProcess
KERNEL32.dll544GetCurrentProcessId
KERNEL32.dll547GetCurrentThread
KERNEL32.dll548GetCurrentThreadId
KERNEL32.dll584GetFileAttributesA
KERNEL32.dll598GetFileType
KERNEL32.dll614GetHandleInformation
KERNEL32.dll617GetLastError
KERNEL32.dll637GetModuleHandleA
KERNEL32.dll640GetModuleHandleW
KERNEL32.dll694GetProcAddress
KERNEL32.dll695GetProcessAffinityMask
KERNEL32.dll732GetStdHandle
KERNEL32.dll755GetSystemTimeAsFileTime
KERNEL32.dll769GetThreadContext
KERNEL32.dll779GetThreadPriority
KERNEL32.dll785GetTickCount64
KERNEL32.dll877InitializeCriticalSection
KERNEL32.dll909IsDBCSLeadByteEx
KERNEL32.dll910IsDebuggerPresent
KERNEL32.dll973LeaveCriticalSection
KERNEL32.dll977LoadLibraryA
KERNEL32.dll980LoadLibraryW
KERNEL32.dll991LocalFree
KERNEL32.dll1024MultiByteToWideChar
KERNEL32.dll1055OpenProcess
KERNEL32.dll1065OutputDebugStringA
KERNEL32.dll1140RaiseException
KERNEL32.dll1182ReleaseSemaphore
KERNEL32.dll1193RemoveVectoredExceptionHandler
KERNEL32.dll1200ResetEvent
KERNEL32.dll1207ResumeThread
KERNEL32.dll1282SetEvent
KERNEL32.dll1310SetLastError
KERNEL32.dll1321SetProcessAffinityMask
KERNEL32.dll1345SetThreadContext
KERNEL32.dll1355SetThreadPriority
KERNEL32.dll1386Sleep
KERNEL32.dll1394SuspendThread
KERNEL32.dll1419TlsAlloc
KERNEL32.dll1421TlsGetValue
KERNEL32.dll1422TlsSetValue
KERNEL32.dll1429TryEnterCriticalSection
KERNEL32.dll1469VirtualProtect
KERNEL32.dll1472VirtualQuery
KERNEL32.dll1479WaitForMultipleObjects
KERNEL32.dll1481WaitForSingleObject
KERNEL32.dll1522WideCharToMultiByte
msvcrt.dll56__doserrno
msvcrt.dll69__mb_cur_max
msvcrt.dll144_amsg_exit
msvcrt.dll145_assert
msvcrt.dll157_beginthreadex
msvcrt.dll165_chdir
msvcrt.dll176_close
msvcrt.dll217_endthreadex
msvcrt.dll221_errno
msvcrt.dll246_fdopen
msvcrt.dll256_filelengthi64
msvcrt.dll260_fileno
msvcrt.dll257_fileno
msvcrt.dll258_findclose
msvcrt.dll262_findfirst
msvcrt.dll268_findnext
msvcrt.dll290_fstat64
msvcrt.dll299_fullpath
msvcrt.dll352_initterm
msvcrt.dll356_iob
msvcrt.dll465_lock
msvcrt.dll471_lseeki64
msvcrt.dll829_mkdir
msvcrt.dll692_setjmp3
msvcrt.dll699_snprintf
msvcrt.dll745_stat
msvcrt.dll752_strdup
msvcrt.dll770_strnicmp
msvcrt.dll660_read
msvcrt.dll831_ultoa
msvcrt.dll842_unlock
msvcrt.dll977_wfopen
msvcrt.dll1010_write
msvcrt.dll1057abort
msvcrt.dll1067atoi
msvcrt.dll1071calloc
msvcrt.dll1083exit
msvcrt.dll1086fclose
msvcrt.dll1089fflush
msvcrt.dll1091fgetpos
msvcrt.dll1097fopen
msvcrt.dll1099fprintf
msvcrt.dll1101fputc
msvcrt.dll1102fputs
msvcrt.dll1105fread
msvcrt.dll1106free
msvcrt.dll1107freopen
msvcrt.dll1115fsetpos
msvcrt.dll1111ftell
msvcrt.dll1118fwrite
msvcrt.dll1121getc
msvcrt.dll1126getwc
msvcrt.dll1132isalpha
msvcrt.dll1140isspace
msvcrt.dll1146iswctype
msvcrt.dll1167memchr
msvcrt.dll1160localeconv
msvcrt.dll1164longjmp
msvcrt.dll1165malloc
msvcrt.dll1173memcmp
msvcrt.dll1174memcpy
msvcrt.dll1175memmove
msvcrt.dll1176memset
msvcrt.dll1179perror
msvcrt.dll1181printf
msvcrt.dll1183putc
msvcrt.dll1186putwc
msvcrt.dll1192realloc
msvcrt.dll1193remove
msvcrt.dll1198setbuf
msvcrt.dll1199setlocale
msvcrt.dll1200setvbuf
msvcrt.dll1204sprintf
msvcrt.dll1209strcat
msvcrt.dll1211strchr
msvcrt.dll1212strcmp
msvcrt.dll1213strcoll
msvcrt.dll1214strcpy
msvcrt.dll1217strerror
msvcrt.dll1218strftime
msvcrt.dll1219strlen
msvcrt.dll1220strncat
msvcrt.dll1222strncmp
msvcrt.dll1223strncpy
msvcrt.dll1226strrchr
msvcrt.dll1232strtol
msvcrt.dll1236strxfrm
msvcrt.dll1250toupper
msvcrt.dll1251towlower
msvcrt.dll1252towupper
msvcrt.dll1253ungetc
msvcrt.dll1254ungetwc
msvcrt.dll1255vfprintf
msvcrt.dll1272wcscoll
msvcrt.dll1276wcsftime
msvcrt.dll1277wcslen
msvcrt.dll1296wcsxfrm
ordentry_vafunction_name
10xe5a0GetExultGamePaths@16
20xf0d0SetExultGamePaths@12
30xecf0VerifyBGDirectory@4
40xeee0VerifySIDirectory@4
module_nameexconfig.dll
flags0
timestamp2020-05-19 20:19:08
version0.0
ordinal_base1
nFunctions4
nNames4
Names(4)0x11f038
Functions(4)0x11f028
NameOrdinals(4)0x11f048

StringTable 0c0904b0

Comments
CompanyName
FileDescriptionExult Config Helper DLL for InnoSetup
FileVersion1, 7, 0
InternalNameexconfig
LegalCopyrightCopyright © 2020
LegalTrademarks
OriginalFilenameexconfig.dll
PrivateBuild
ProductNameExult
ProductVersion1.7.0git
SpecialBuild

VS_FIXEDFILEINFO

FileVersion1.7.0.0
ProductVersion1.7.0.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
01200128DLL01/01/1970 00:00:00#
15c115HTM#
12500014BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 1200142 bytes (1173 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x11e144